xtremerat

General

Target

JaffaCakes118_95276726193756b572ee099f729d35eb
Size

294KB
Sample

250117-xy537azpf1
MD5

95276726193756b572ee099f729d35eb
SHA1

139884ed1785f7eb036d5402e3dddb7b14a5966f
SHA256

25d52cb61ae3def0929808d950ae42dfad2942a85d080246fbe738025577297c
SHA512

af90b7206d602c846a2f92d07a46f84cf41c1830cf7a04d469a6f6c28e90baece9e589df55df8c766b35c6ae27104c01ffd73fddd8c8fa44595aefcae19daa93
SSDEEP

6144:KP1+O1/pbgkC+MQABPqUNTb8MZgZOxzf/m4TyQOI5JgpcvqNplcC41p4uO:KPtTbgk3MQvc7//T0Iw5p341jO

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_95276726193756b572ee099f729d35eb
- Size
  
  294KB
- MD5
  
  95276726193756b572ee099f729d35eb
- SHA1
  
  139884ed1785f7eb036d5402e3dddb7b14a5966f
- SHA256
  
  25d52cb61ae3def0929808d950ae42dfad2942a85d080246fbe738025577297c
- SHA512
  
  af90b7206d602c846a2f92d07a46f84cf41c1830cf7a04d469a6f6c28e90baece9e589df55df8c766b35c6ae27104c01ffd73fddd8c8fa44595aefcae19daa93
- SSDEEP
  
  6144:KP1+O1/pbgkC+MQABPqUNTb8MZgZOxzf/m4TyQOI5JgpcvqNplcC41p4uO:KPtTbgk3MQvc7//T0Iw5p341jO
Score

10^/10

xtremerat bootkit discovery persistence rat spyware upx
- Detect XtremeRAT payload
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2